doc/administration/gitlab_duo/configure/access_control.md
{{< details >}}
{{< /details >}}
{{< history >}}
{{< /history >}}
You can turn GitLab Duo on or off for a group, or restrict access to GitLab Duo and Agent Platform to specific groups only.
{{< history >}}
{{< /history >}}
{{< tabs >}}
{{< tab title="On GitLab.com" >}}
Prerequisites:
To give access to specific Agent Platform features for a top-level group:
In the top bar, select Search or go to and find your group.
Select Settings > GitLab Duo.
Select Change configuration.
Under Limit access based on group membership, select Add group.
From the dropdown list, select an existing subgroup.
When you add the first group, a default All eligible users rule is also added. You can use this rule to configure access for all other users. This rule is automatically deleted when it has no access to GitLab Duo or Agent Platform and all existing groups are removed.
Select the features that direct group members can access.
Select Save changes.
These settings apply to:
When you configure group-based access controls, you can select only groups that are direct subgroups of the top-level group. You cannot use nested subgroups in access control rules.
[!note] If groups are configured, users must be direct members of one of those groups to have access to GitLab Duo and Agent Platform features or you can use the All eligible users configuration. Access is additionally determined by other access methods. {{< /tab >}}
{{< tab title="On GitLab Self-Managed" >}}
Prerequisites:
To give access to specific Agent Platform features for an instance:
In the upper-right corner, select Admin.
In the left sidebar, select GitLab Duo.
Select Change configuration.
Under Limit access based on group membership, select Add group.
From the dropdown list, select an existing group.
When you add the first group, a default All eligible users rule is also added. You can use this rule to configure access for all other users. This rule is automatically deleted when it has no access to GitLab Duo or Agent Platform and all existing groups are removed.
Select the features that direct group members can access.
Select Save changes.
These settings apply to users who are direct members of one of the configured groups under Limit access based on group membership. The user can now access these features when they are turned on.
When you configure group-based access controls, you can select only top-level groups. You cannot use subgroups in access control rules.
[!note] If groups are configured, users must be direct members of one of those groups to have access to GitLab Duo and Agent Platform features or you can use the All eligible users configuration. Access is additionally determined by other access methods. {{< /tab >}}
{{< /tabs >}}
If you do not want to manually manage group membership, you can synchronize membership by using LDAP or SAML.
When a user is assigned to more than one group, they access features from all assigned groups. For example:
In this example, the user has access to both GitLab Duo features and Agent Platform.
If All eligible users is configured:
Additional controls (such as disabling features for the top-level group or instance) still apply.
If you use LDAP or SAML for authentication, you can synchronize group membership automatically:
For more information, see:
You can use access control for phased rollouts or testing and validation.
To implement a phased rollout of GitLab Duo or Agent Platform:
pilot-users).To test GitLab Duo or Agent Platform capabilities in a controlled environment:
agent-testers).agent-testers group.If a user cannot access GitLab Duo or Agent Platform features, it might be because GitLab Duo or Agent Platform is either:
To resolve this issue, either:
In GitLab 18.8 and earlier, if you give a group access to Agent Platform but not to GitLab Duo, the GitLab Duo sidebar does not display for members of that group. As a workaround, ensure the group has access to both GitLab Duo and Agent Platform features.
To resolve this issue, upgrade to GitLab 18.9 or later.